"Baiterg" LLC is a Russian developer and manufacturer of radio-electronic products, specializing in mobile and personal video surveillance complexes, mobile communication devices, and special-purpose video surveillance systems.
Why work with us:
- 30 years of experience in the radio electronics market;
- work on projects for aviation, special transport, and security systems;
- professional interaction with experienced colleagues;
- career-changing opportunities.
Become part of a team that is creating the future of Russian electronics!
Job Responsibilities:
- Security in the Development Stage (Shift Left)
- find and fix vulnerabilities as early as possible, during the coding stage;
- analysis of code and dependencies: implementation and configuration of static analysis tools (SAST) for finding vulnerabilities in the source code, as well as analysis of third-party libraries and components used (SCA) for known vulnerabilities (CVE);
- secret search: automation of code and configuration checks for accidentally "committed" passwords, API keys, and tokens.
- Security Automation in CI/CD
- integration of protective mechanisms into continuous integration and delivery pipelines;
- embedding checks: configuration of automatic security checks (SAST, DAST, SCA, container scanning) in CI/CD pipelines (e.g., in GitLab CI, GitHub Actions, Jenkins);
- quality management: implementation of "Quality Gates" that can stop a release if critical security checks are not passed.
- Infrastructure and Cloud Environment Security
- ensuring the security of the infrastructure on which applications run;
- Infrastructure as Code (IaC): checking Terraform, Ansible, or CloudFormation configurations for security errors before deployment;
- container security: scanning Docker images for vulnerabilities before and after assembly, ensuring Kubernetes cluster security (RBAC configuration, network policies);
- cloud security: configuration and monitoring of security policies in clouds (AWS, Azure, GCP), access management (IAM), configuration control.
- Monitoring and Incident Response
- continuous monitoring of the security of operating systems.
- monitoring and logging: Configuration of monitoring and log collection systems (e.g., ELK, Prometheus, SIEM) to detect suspicious activity.
- response: Participation in information security incident investigations and development of plans for their future prevention.
Requirements:
- CI/CD: GitLab CI, GitHub Actions, Jenkins;
- containerization and orchestration: Docker, Kubernetes;
- scripting languages: Python, Bash, sometimes Go or PowerShell;
- IaC: Terraform, Ansible, CloudFormation;
- cloud platforms: AWS, Azure, GCP;
- security tools: SAST/DAST (SonarQube, OWASP ZAP), SCA (Snyk, Dependency-Track), container scanning (Trivy, Kaspersky Container Security);
- secret management: HashiCorp Vault, cloud provider solutions;
- understanding of vulnerabilities: OWASP Top 10, methods for their detection and elimination;
- work experience: 5-8 years in a similar position;
- knowledge of key documents: knowledge of GOST R 56939-2024 "Development of Secure Software", Orders of FSTEC (No. 17, No. 117, No. 240) is required;
- understanding of classification: division of systems into security classes (K1, K2, K3) for GIS and understanding the requirements for information security tools (IST) depending on this class;
- working with certified IST: experience in using and configuring firewalls, IDS, antiviruses certified by FSTEC (for example, when working with K1 class GIS, IST of protection class 4 or higher is required).
- evidence-based security: configuring processes so that every action leaves a "digital trail" for auditing (end-to-end traceability from requirement to release).
- secure CI/CD: ensuring pipeline security (CI/CD), logging all developer actions, and controlling the integrity of the build environment.
- understanding of SSDLC: knowledge of the secure software development lifecycle methodology.
- communication skills: ability to work in a team with developers, administrators, and security specialists, explain risks, and justify the need for changes.
Conditions:
- office within walking distance of ZIL metro station and ZIL MCC (ZIL Technopark);
- official employment under the Labor Code of the Russian Federation;
- schedule: five-day working week from 9:30 to 18:00;
- training and professional development at the company's expense;
- opportunity to prove yourself in professional competitions;
- professional team, atmosphere of mutual respect;
- rich corporate life;
- VHI with dentistry;
- compensation for sports activities;
- bonuses based on year-end results, regular salary indexation;
- salary level is determined individually based on the candidate's experience, skills, and professional achievements.
